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As  you  requested,  we  examined  controls  over  materials  during  the 
receiving  process  at  Clark  Air  Base  in  the  Philippines.  The  Clark  Air 
Base  3rd  Supply  Squadron  manages  about  145,000  different  items  val¬ 
ued  at  about  $174  million.  These  items  support  13th  Air  Force  opera¬ 
tions  and  include  such  items  as  tools,  aircraft  repair  parts,  fuels  and 
lubricants,  and  construction  materials  and  equipment.  We  focused  on 
the  supply  squadron,  and  did  not  assess  overall  security  at  Clark  Air 
Base. 


-  We  found  that  the  squadron  processed  most  material  receipts  as 
required.  However,  we  found  severalj&eaknesses  that  increase  the 
chance  of  fraud,  waste,  and  abuse  (see-appJ):  These  weaknesses 
included  not  reporting  certain  shipping  discrepancies,  not  verifying  and 
analyzing  discrepancies,  inadequate  physical  security,  and  insufficiently 
separating  duties  for  supply  receipts  and  issues. 


Clark  Air  Base  supply  squadron  officials  did  not  always  comply  with 
defense  supply  policy,  which  requires  identifying  and  reporting  material 
shipments  that  are  more  than  90  days  overdue.  The  cases  of  noncompli¬ 
ance  we  identified  involved  material  that  (1)  the  base  did  not  pay  for  f- 
and  (2)  was  government-owned  property  from  supply  organizations.  | 
Because  overdue  items  may  have  been  lost  or  stolen,  the  squadron  needs  ^ 
to  report  these  overdue  requisitions  to  appropriate  authorities,  allowing 
them  to  initiate  action  to  identify  the  cause  of  the  delay. 

Air  Force  guidelines  also  require  reporting  discrepancies  in  quantity  or 
quality  of  materials  received.  The  squadron  did  not  always  meet  the 
requirements  to  verify  discrepancies  and  report  them  on  time. 

Squadron  security  personnel  did  not  take  basic  security  precautions, 
such  as  controlling  visitor  entry  and  departure  from  the  supply  com¬ 
pound,  properly  installing  security  equipment,  properly  inspecting  all 
packages  carried  through  pedestrian  gates,  and  repairing  many  large 
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holes  in  the  perimeter  fence.  From  January  1984  to  May  1987,  the  sup¬ 
ply  squadron  reported  suspected  property  thefts  totaling  about  $3.6 
million. 

Some  squadron  personnel  could  access  the  supply  computer  to  record 
both  item  receipt  and  issue  transactions.  This  practice  violates  a  basic 
control  principle  to  keep  the  responsibility  for  receiving  items  separate 
from  the  responsibility  for  issuing  items.  If  these  two  functions  are  sepa¬ 
rate,  two  individuals  must  then  collude  to  adjust  the  accounting  records 
to  cover  up  the  theft  of  items.  However,  if  an  individual  is  responsible 
for  recording  both  receipt  and  issue  transactions,  that  individual  acting 
alone  could  create  a  false  item  history,  making  it  difficult  to  identify 
potential  thefts.  Another  control  that  could  help  ensure  that  use  of  the 
supply  computer  is  limited  to  authorized  purposes  would  be  to  record 
times  that  users  signed  on  and  off  the  computer.  However,  the  squadron 
did  not  have  a  procedure  to  accomplish  this. 

To  determine  whether  the  material  control  weaknesses  we  identified 
were  limited  to  Clark  Air  Base  or  were  more  widespread,  we  inquired 
whether  specific  weaknesses  identified  at  Clark  Air  Base  also  existed  at 
Air  Force  installations  in  Hawaii,  Korea,  and  Japan.  We  were  told  that 
none  of  the  bases  reported  overdue  shipments  that  were  not  paid  for  by 
the  bases.  Also,  Hickam  Air  Force  Base  in  Hawaii  did  not  control  sign  on 
and  off  times  on  its  computer  terminals.  This  suggests  that  these  two 
weaknesses  may  exist  at  other  Air  Force  installations. 


We  believe  that  the  conditions  noted  at  Clark  Air  Base  indicate  a  need  to 
reemphasize  physical  and  computer  security  controls.  We  therefore  rec¬ 
ommend  that  the  Secretary  of  the  Air  Force 

•  ensure  that  Air  Force  installations  submit  discrepancy  reports  and  fol¬ 
low  up  on  overdue  material  shipments  in  accordance  with  Department 
of  Defense  guidance; 

•  incorporate  computer  supply  system  controls  in  Air  Force  guidance, 
especially  to  ensure  separation  of  duties  for  receipt  and  issue  transac¬ 
tions  where  practicable;  and 

•  ensure  that  the  Clark  Air  Base  supply  squadron  corrects  the  specific 
weaknesses  we  identified,  including  physical  security,  verification  of 
discrepancies,  and  timely  reporting. 
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Agency  Comments  and 
Our  Evaluation 


The  Department  of  Defense  (dod)  generally  concurred  with  our  findings 
and  recommendations  but  suggested  some  changes  to  the  report.  We 
agreed  with  dod’s  suggestions  and  incorporated  them  as  described  in 
appendixes  I  and  II. 


As  arranged  with  your  offices,  unless  you  publicly  announce  its  contents 
earlier,  we  plan  no  further  distribution  of  this  report  until  30  days  from 
its  issue  date.  At  that  time,  we  will  send  copies  to  the  Subcommittees  on 
Defense,  Senate  and  House  Committees  on  Appropriations;  the  Senate 
and  House  Committees  on  Armed  Services;  and  other  interested  commit¬ 
tees;  the  Secretary  of  Defense;  the  Secretary  of  the  Air  Force;  the  Direc¬ 
tor,  Office  of  Management  and  Budget;  and  other  interested  parties  upon 
request. 

This  report  was  prepared  under  the  direction  of  Martin  M  Ferber,  Senior 
Associate  Director.  Other  major  contributors  are  listed  in  appendix  III. 
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Supply  Security  at  Clark  Air  Base 


The  Clark  Air  Base  3rd  Supply  Squadron  procures,  stores,  and  distrib¬ 
utes  supplies  for  the  13th  Air  Force’s  operations.  The  squadron  manages 
about  145,000  line  items  worth  about  $174  million.  The  four  largest 
classes  include  most  of  these  line  items.  Class  II  includes  tools,  equip¬ 
ment,  and  supplies.  Class  III  includes  petroleum  fuels  and  lubricants. 
Class  IV  includes  construction  material  and  equipment.  Class  IX  includes 
aircraft  and  support  equipment  repair  parts. 

The  squadron  supports  88  assigned  aircraft  (including  F-4s  and  C-130s) 
and  about  14,100  transient  aircraft  a  year.  During  1986,  the  squadron 
processed  about  145,000  customer  orders  and  139,000  receipts. 

Air  Force  Regulation  400-54,  dated  October  1,  1986,  requires  receiving 
and/or  transshipment  activities  to  report  discrepancies  in  material  ship¬ 
ments  to  the  activity  that  shipped  the  item.  This  regulation  establishes 
the  procedures  on  how  to  support  adjustments  to  records,  make  claims, 
and  notify  shippers.  Discrepancies  may  involve  shipments  that  are  over¬ 
due  or  variations  in  the  quantity  or  quality  of  material.  Discrepancy 
reports  notify  shippers  and  base  supply  managers  of  problems,  and  doc¬ 
ument  circumstances  to  help  determine  the  cause  of  the  discrepancy,  ini¬ 
tiate  corrective  action,  and  prevent  recurrence. 

For  reporting  purposes,  shipments  are  classified  as  overdue  when  they 
are  not  received  within  90  days  from  the  date  of  shipment.  As  of  July  2, 
1987,  the  supply  squadron  had  more  than  $1  million  worth  of  overdue 
shipments. 


We  found  that  the  supply  squadron  did  not  consistently  follow  required 
procedures.  It  did  not  always  report  discrepant  shipments,  verify  dis¬ 
crepancies,  or  follow  physical  security  rules.  We  also  found  weaknesses 
in  controls  over  automated  processing  of  supply  transactions. 


Overdue  Material 
Shipments  Not  Always 
Reported 


Air  Force  Regulation  400-54  requires  receiving  and/or  transshipment 
activities  to  report  certain  material  not  received  within  90  days  from  the 
date  of  shipment.  In  July  1987,  169  overdue  parcel  post  shipments  val¬ 
ued  at  about  $146,000  should  have  been,  but  were  not,  identified  and 
reported  as  overdue.  All  the  cases  of  noncompliance  that  we  identified 
involved  government-owned  property  from  supply  organizations  such  as 
Air  Force  air  logistics  centers  and  Defense  Logistics  Agency  supply 
centers. 
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Supply  Security  at  Clark  Air  Base 


Pacific  Air  Forces  and  Clark  Air  Base  supply  officials  stated  that  the 
squadron  did  not  report  overdue  material  shipments  where  the  base  had 
not  paid  for  them.  The  officials  attributed  this  practice  to  the  absence  of 
Air  Force  guidance  regarding  reporting  requirements  for  overdue  ship¬ 
ments  that  are  not  paid  for  by  the  receiving  installation.  The  guidance 
states  that  certain  overdue  shipments  above  specific  dollar  values  must 
be  reported.  We  believe  the  guidance  is  applicable  to  both  paid  and 
unpaid  items  overdue  after  90  days  of  their  anticipated  shipment  dates. 

We  also  found  that  other  Air  Force  bases  were  not  submitting  discrep¬ 
ancy  reports  for  overdue  parcel  post  shipments  not  paid  for  by  the 
bases.  We  observed  that  Hickam  Air  Force  Base,  Hawaii,  did  not  submit 
discrepancy  reports  for  overdue,  unpaid  for  items  as  required  by 
defense  procedures.  Also,  supply  officials  at  Osan  Air  Base,  Korea,  and 
Kadena  Air  Base,  Okinawa,  stated  that  they  also  did  not  report  any 
overdue  items  that  the  bases  had  not  paid  for.  We  believe  that  since  this 
problem  was  found  at  several  Air  Force  bases  in  the  Pacific  and 
involved  the  same  regulations,  the  problem  could  exist  elsewhere  as 
well. 


In  commenting  on  our  draft  report,  the  Department  of  Defense  (dod) 
ctated  there  was  an  implication  that  a  report  of  discrepancy  was 
required  for  every  overdue  shipment.  We  modified  the  report  to  specifi¬ 
cally  identify  parcel  post  shipments  that  are  required  to  be  reported  as 
overdue  under  defense  procedures,  dod  agreed  that  follow-up  for  over¬ 
due  material  is  required  regardless  of  funding. 


Discrepancy  Reports 
Not  Properly 
Processed 


Air  Force  guidelines  require  reports  of  any  discrepant  shipments  within 
15  days  of  receipt,  and  also  require  a  second  person  to  verify  errors  in 
quantity.  During  1986,  base  supply  reported  901  discrepant  shipments. 
In  two  judgmental  tests  of  discrepancy  reports  from  1986  and  1987,  we 
found  the  following: 


•  Seven  of  13  discrepancy  reports  involving  various  discrepancies 
exceeded  the  15-day  standard.  The  supply  squadron  processed  the  7 
reports  from  20  to  62  days  after  receiving  the  shipment. 

•  Ten  of  14  receipts  for  14  discrepancies  in  quantity  were  not  verified  by 
a  second  person. 


In  commenting  on  our  draft  report,  dod  stated  that  Clark  Air  Base  now 
submits  timely  reports  and  verifies  discrepancies  as  required. 
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Appendix  1 

Supply  Security  at  Clark  Air  Base 


Several  regulations  govern  the  protection  of  resources  at  Clark  Air  Base. 

Air  Force  Regulation  125-37,  dated  July  1984,  sets  minimum  standards 
to  protect  Air  Force  resources,  and  3rd  Supply  Squadron  Regulations 
125-1  and  125-2,  dated  September  and  October  1986,  respectively, 
assign  responsibilities  and  outline  procedures  to  protect  government 
property. 

From  January  1984  to  May  1987,  the  supply  squadron  reported  sus¬ 
pected  property  thefts  totaling  about  $3.6  million.  According  to  Air 
Force  officials,  the  squadron  has  tailored  its  security  controls  to  its  sup¬ 
ply  operation  to  minimize  such  losses.  A  special  security  unit  is  to  per¬ 
form  security  surveillance  activities  over  supply  operations.  The 
activities  include  using  badges  to  control  entry  to  the  supply  compound 
and  searching  exiting  personnel  by  using  metal  detectors.  Fences  enclose 
the  main  supply  compound  and  closed  circuit  video  cameras  should 
monitor  strategic  areas  in  the  compound.  Security  personnel  are  to 
check  properly  leaving  the  supply  compound  and  inspect  the  compound 
daily  for  hidden  property. 

However,  we  found  that  weaknesses  in  physical  security  were  numerous 
and  pervasive,  and  could  impair  base  supply’s  security  programs.  These 
weaknesses  involved  (1)  personnel  identification  and  visitor  registra¬ 
tion,  (2)  pilferable  item  controls,  (3)  security  equipment,  and  (4)  perime¬ 
ter  security.  Air  Force  inspectors  and  investigators  have  also  identified 
similar  physical  security  weaknesses. 

The  squadron  did  not  follow  its  security  regulations  on  the  use  of  identi¬ 
fication  budges.  For  example,  we  observed  the  following: 

•  Supply  personnel  did  not  display  their  identification  badges  within  the 
compound  and  were  not  challenged  by  security  personnel. 

•  Visitors  could  enter  the  supply  compound  without  identification  badges, 
even  though  it  is  a  controlled  area.  For  example,  catering  truck  drivers 
were  allowed  in  the  compound  without  being  issued  identification 

badges.  i 

•  In  some  instances,  the  squadron  issued  a  single  visitor  badge  to  more 
than  one  visitor  and  did  not  check  all  visitors’  credentials. 

The  squadron  did  not  maintain  a  pedestrian  registration  log  in  the  man¬ 
ner  required,  thus  weakening  control  over  visitors  to  the  supply  com¬ 
pound.  During  one  7-day  period,  180  visitors  (34  percent  of  the  533  who 
signed  in)  did  not  sign  out  on  the  log.  Also,  many  visitors  did  not  put 
their  arrival  times  on  the  log. 
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Supply  Security  al  Clark  Air  Base 


Supply  procedures  require  security  personnel  to  inspect  all  packages 
carried  through  the  pedestrian  gate.  However,  we  observed  exceptions 
during  our  visit.  For  example,  two  civilians  carried  boxes  through  the 
pedestrian  gate  without  guards  inspecting  the  contents  or  examining 
documents. 

The  supply  squadron  did  not  control  pilferable  items  as  required.  For 
example,  we  found  20  items  coded  pilferable  being  stored  in  a  delivery 
area  outside  of  the  security  cage  at  one  warehouse. 

Air  Force  regulations  require  video  cameras  to  be  positioned  to  provide 
maximum  surveillance  of  highly  pilferable,  sensitive,  and  high  dollar 
value  items.  Although  the  supply  office  used  video  cameras  for  security, 
the  cameras  did  not  monitor  key  areas.  Camera  positioning  precluded 
monitoring  the  material  receipts  staging  area,  the  receiving  security 
cage,  and  strategic  gate  and  perimeter  fence  areas.  Also,  three  of  six- 
video  cameras  did  not  have  sufficient  light,  during  the  day  or  night,  to 
monitor  the  supply  compound  warehouses. 

Air  Force  regulations  require  such  physical  safeguards  as  fences,  gates, 
and  window  screens  to  prevent  access  by  unauthorized  persons.  We 
found  many  large  holes  in  the  supply  compound  perimeter  fence,  which 
could  allow  unauthorized  personnel  access  to  the  compound.  An  Air 
Force  supply  official  stated  that  the  entry  of  unauthorized  personnel 
has  been  a  long-standing  problem.  During  our  visit,  the  civil  engineering 
squadron  approved  two  work  orders  to  place  razor  wire  in  the  areas  of 
frequent  intrusion.  We  believe  these  repairs  will  reduce  the  potential  for 
unauthorized  access  through  the  squadron's  perimeter  fence. 

In  commenting  on  our  draft  report,  non  concurred  with  our  findings  and 
described  actions  at  Clark  Air  Base  to  improve  physical  security. 


Physical  Security 
Weaknesses  Noted  in 
Internal  Air  Force 
Inspections 


Air  Force  reports  identified  many  incidents  that  further  illustrate  weak¬ 
nesses  in  the  squadron's  physical  security. 

An  August  lhHn  inspection  team  report  cited  insufficient  management 
emphasis  and  training  and  a  lack  of  awareness  of  the  importance  of 
physical  security.  The  team  reported  property  left  in  unsecured  areas 
during  processing  and  doors  often  left  ajar  in  warehouse  areas.  It  also 
criticized  superficial  searches  of  vehicles  and  property  leaving  the  com¬ 
pound  and  improper  processing  of  classified  and  sensitive  items. 
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Supply  Security  at  Clark  Air  Ba.se 


The  Air  Force  Office  of  Special  Investigations  has  reported  many  thefts 
from  the  Clark  Air  Base  supply  compound.  From  .January  through  .July 
1987,  it  resolved  two  suspected  thefts  totaling  over  $70. 000  of  aircraft 
parts.  In  1980,  five  investigations  identified  about  $104,000  worth  of 
stolen  aircraft  parts  and  other  items.  As  a  result  of  follow-up,  the  Air 
Force  dismissed  three  supply  employees  and  recovered  materials  worth 
about  $04,070. 

In  .July  1987,  the  Office  of  Special  Investigations  reported  physical 
security  weaknesses  at  the  Clark  supply  compound.  These  weaknesses 
included  supply  gates  found  unattended,  gate  guards  unaware  of  their 
responsibilities,  and  a  large  hole  in  the  perimeter  fence  line.  The  report 
also  noted  that  the  squadron  did  not  maintain  visitor  control  logs  cor¬ 
rectly  and  that  its  security  video  cameras  provided  poor  picture  resolu¬ 
tion  in  daylight  and  none  at  night. 


Limited  Control  Over 
Computer  System 
Access 


Assigning  key  supply  management  responsibilities  to  a  number  of  indi¬ 
viduals  helps  to  ensure  that  effective  checks  and  balances  exist.  Sepa¬ 
rating  supply  receipt  and  issue  duties  could  reduce  the  risk  of  abuse  and 
is  a  common  management  control  cited  in  internal  audit  and  automated 
data  processing  guidelines.  For  example,  the  President’s  Councils  on 
Management  Improvement  and  on  Integrity  and  Efficiency  cited  the 
need  for  separation  of  duties  and  highlighted  the  risk  that  an  automated 
system  can  allow  an  individual  to  circumvent  the  separation  of  duties 
control  instituted  in  manual  systems.  Air  Force  guidance  does  not 
require  that  these  supply  management  duties  be  separated  in  its  auto¬ 
mated  processing  system,  and  we  found  that  19  of  21  receiving  person¬ 
nel  (about  90  percent)  and  134  of  261  squadron  supply  personnel  (about 
5 1  percent)  could  perform  both  receipt  and  issue  supply  transactions. 


Air  Force  regulations  require  computer  users  to  sign  off  a  terminal  when 
finished.  By  documenting  who  used  the  terminal,  this  safeguard  helps 
limit  access  to  the  computer  terminals  to  authorized  staff.  The  supply 
squadron  documented  user  identity,  but  had  no  way  to  determine  sign 
on  and  off  times.  If  its  computer  system  automatically  recorded  times  in 
use,  the  squadron  could  identify  long  use  times,  which  might  indicate  a 
terminal  being  left  unattended,  or  limit  terminal  use  to  normal  working 
hours  by  identifying  patterns  of  transactions  at  unusual  times.  The 
Hickam  Air  Force  Base  supply  computer  security  officer  informed  us 
that  Hickam  also  does  not  monitor  sign  on  and  off  times. 
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Supply  Security  at  Clark  Air  Base 


In  commenting  on  our  draft  report,  dod  stated  that  greater  separation  of 
duties  is  desirable,  but  may  not  be  possible  in  such  cases  as  small  supply 
offices,  dod  further  stated  that  other  controls  may  be  more  cost-effec¬ 
tive  than  documenting  log  on  and  off  times  at  computer  terminals.  We 
agree  and  have  modified  our  recommendations  to  recognize  that  separa¬ 
tion  of  duties  may  not  be  always  possible,  and  that  other  controls  may 
also  be  used  to  improve  computer  security. 


Objectives,  Scope,  and 
Methodology 


Our  objective  at  the  Clark  Air  Base  supply  squadron  was  to  assess  con¬ 
trols  to  ensure  that  ordered  materials  are  received,  discrepancies  are 
reported,  and  losses  are  minimized.  We  evaluated  management  proce¬ 
dures  and  practices  to  safeguard  material  receipts.  We  also  identified 
controls  over  supply  security  before  and  after  material  was  received.  We 
did  not  assess  overall  base  security,  nor  did  we  assess  security  over 
material  issued  to  other  organizations  at  Clark  Air  Base  that  use  mate¬ 
rial  provided  by  the  supply  squadron. 


We  performed  our  work  from  May  through  October  1987.  We  worked  at 
the  headquarters  of  the  Pacific  Air  Forces  in  Hawaii  and  at  Clark  Air 
Base  in  the  Philippines. 


We  reviewed  Air  Force  and  local  procedures  and  practices  for  processing 
material  receipts.  We  examined  the  supply  squadron’s  shipping  discrep¬ 
ancy  reports  and  compliance  with  physical  and  computer  supply  secur¬ 
ity  requirements.  We  also  interviewed  Air  Force  officials  responsible  for 
carrying  out  these  activities,  examined  records,  and  tested  supply  trans¬ 
actions.  Because  the  Clark  Air  Base  supply  squadron  generally  did  not 
maintain  historical  records  of  shipping  discrepancies,  we  limited  most 
tests  to  transactions  in  process  at  the  time  of  our  visit.  We  reviewed 
reports  issued  by  defense  audit  and  investigative  agencies  to  identify 
previously  reported  supply  management  problems. 

Our  review  was  made  in  accordance  with  generally  accepted  govern¬ 
ment  auditing  standards. 
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end  of  this  appendix 


ASSISTANT  SECRETARY  OF  DEFENSE 
WASHINGTON  DC  20301-8000 


NOV  2  1968 


Mr.  Frank  C.  Conahan 
Assistant  Comptroller  General 
National  Security  and  International 
Affairs  Division 
U.S.  General  Accounting  Office 
Washington,  DC  20548 

Dear  Mr.  Conahan: 

This  is  the  Department  of  Defense  (DoD)  response  to  the  General 
Accounting  Office  (GAO)  draft  report,  "SUPPLY  SECURITY:  Air  Force 
Controls  Need  to  be  Strengthened,"  dated  August  25,  1988, 

(GAO  Code  391594),  OSD  Case  7746. 

The  Department  is  pleased  that  the  GAO  found  that  the  Clark  Air 
Base  supply  squadron  "processed  most  material  receipts  as  required, " 
and  that  the  Air  Force  has  taken  aggressive  action  to  correct  the 
deficiencies  identified  in  the  draft  GAO  report.  The  Department 
generally  concurs  or  partially  concurs  with  the  draft  report  findings 
and  recommendations  and  has  suggested  changes  to  the  recommendations, 
which  would  allow  full  concurrence  with  the  recommendations.  The 
Department  recognizes  that  this  area  requires  constant  vigilance  and 
high  level  management  attention  in  order  to  reduce  the  vulnerability 
of  material  loss. 

The  enclosure  documents  the  Department's  detailed  comments  on  the 
report  findings  and  recommendations.  The  GAO  was  separately  provided 
with  suggested  technical  corrections  during  a  meeting  on  October  4, 
1988.  The  DoD  appreciates  the  opportunity  to  comment  on  the  draft 
report . 


,ierle  Freitag,  KG, 
Military  Deputy 


Enclosure 
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GAO  DRAFT  REPORT  -  DATED  AUGUST  25,  1988 
1  (GAO  CODE  391594)  OSD  CASE  7746 

!  "SUPPLY  SECURITY:  AIR  FORCE  CONTROLS  NEED  TO  BE  STRENGTHENED" 


I 


Now  on  pp  1 , 6-7 


DEPARTMENT  OF  DEFENSE  COMMENTS 

***** 

FINDINGS 

FINDING  A:  Overdue  Material  Shipment  Not  Always  Reported.  The  GAO 

found  that  the  Air  Force  supply  squadron  officer  at  Clark  Air  Base 
was  not  reporting  material  not  received  within  90  days  from  the  date 
of  anticipated  shipment  in  accordance  with  Air  Force  Regulation 
400-54.  The  GAO  estimated  that,  in  July  of  1987,  about  240  overdue 
material  shipments  valued  at  about  $360,000  should  have  been,  but 
were  not,  identified  and  reported  under  Defense  procedures.  The  GAO 
noted  that  all  of  the  cases  it  identified  involved  Government-owned 
property  from  supply  organizations  such  as  Air  Force  Air  Logistics 
Centers  and  Defense  Logistics  Agency  Supply  Centers.  The  GAO 
reported  Pacific  Air  Forces  and  Clark  Air  Base  supply  officials 
stated  that  overdue  material  shipments  were  not  reported  because  the 
base  had  not  paid  for  them.  According  to  the  GAO,  the  supply 
officers  attributed  this  practice  to  a  lack  of  guidance  from  the  Air 
Force  regarding  reporting  requirements  for  overdue  shipments  that  are 
not  paid  for.  The  GAO  reviewed  the  existing  Air  Force  guidance  and 
concluded  the  existing  guidance  required  that  both  paid  for  and 
unpaid  items  were  required  to  be  reported  after  90  days  of  shipment. 
The  GAO  also  found  that  other  Air  Force  bases  were  not  submitting 
discrepancy  reports  for  not  paid  for  overdue  shipments.  The  GAO 
observed  that  Hickam  Air  Force  Base,  Hawaii,  did  not  submit 
discrepancy  reports  for  overdue,  unpaid  for  items.  In  addition, 
according  to  the  GAO,  supply  officials  at  Osan  Air  Base,  Korea,  and 
Kadina  Air  Base,  Okinawa,  stated  that  they  did  not  report  overdue, 
unpaid  for  items.  Since  the  items  identified  were  all  Government 
property  and  may  have  been  lost  or  stolen,  the  GAO  concluded  that  the 
Air  Force  should  report  and  account  for  such  discrepancies.  Also, 
since  the  problem  was  found  at  several  Air  Force  bases  in  the  Pacific 
and  involved  interpreting  the  same  regulations,  the  GAO  concluded 
that  the  problem  could  be  general,  (p.  1,  pp.  4-6/GAO  Draft  Report) 

DOD  RESPONSE:  Partially  concur.  The  Department  concurs  Clark  Air 
Base  (AB)  was  not  following  up  on  overdue  shipments  of  items  that 
were  not  funded  by  the  base.  The  Department  also  concurs  that  the 
Air  Force  regulation  400-54  requires  all  overseas  bases  to  follow-up 
on  overdue  parcel  post  shipments  valued  at  $100  or  more,  within  90 
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days  of  shipment,  regardless  of  funding  source.  The  tracer 
reconciliation  program  (GV  597)  is  primarily  an  automated  financial 
system  that  monitors  receipts  and  produces  management  notices  telling 
management  to  submit  discrepancy  reports  for  funded  items.  It  does 
not  maintain  details  for  the  material  shipped  from  the  Air  Force 
Logistics  Command  (AFLC) ,  because  it  is  not  funded  at  the  base  level. 
The  Air  Force  Pacific  Command  (PACAF)  had  interpreted  the  lack  of 
automated  management  notices  as  eliminating  the  requirement  to 
follow-up  on  material  not  paid  for  (e.g.,  a  source  of  supply  like  the 
AFLC) .  The  PACAF  has  been  notified  that  their  interpretation  is 
incorrect  and  that  follow-up  for  overdue  material  is  required, 
regardless  of  funding,  in  accordance  with  AFR  400-54. 

The  Department  nonconcurs  with  the  implication  that  a  report  of 
discrepancy  (ROD)  is  required  for  every  overdue  shipment.  The 
follow-up/discrepancy  reporting  process  is  conducted  by  several 
activities,  depending  upon  numerous  variables.  It  appears  that  the 
GAO  report  lumps  all  types  of  follow-up  together.  The  following 
requirements  pertain  to  overdue  shipments  and  the  RODs  and  are 
submitted  to  help  clarify  the  GAO  report: 

Tracking  Receipts:  When  a  requisition  is  submitted,  a  due-in  file  is 
automatically  established.  Overdue  shipments  are  traced  in  three 
ways : 

The  standard  base  supply  system  (SBSS)  automatically  establishes 
a  suspense  system  for  requisitioned  material.  It  i3  a  program 
control  follow-up.  Based  on  material  priority  groups,  the  program 
automatically  produces  follow-up  actions  when  material  is  not 
received  by  the  estimated  time  of  delivery.  (Section  F,  Chapter  9, 
Volume  II,  Part  Two,  AFM  67-1.)  The  follow-up  action  for  these 
overdue  items  is  an  automated  supply  document,  NOT  a  ROD. 

The  transportation  system  uses  a  Military  Standard  Transportation 
and  Movement  Procedures  (MILSTAMP)  tracer  reconciliation  program  to 
trace  shipments  that  are  delayed  or  misplaced  between  shipper  and 
requisitioner  (Paragraph  194,  Section  M,  Chapter  9,  Volume  II,  Part 
Two,  AFM  67-1) .  This  is  referred  to  as  the  Transportation  Action 
Required  (TAR)  listing. 

Parcel  post  shipments  to  overseas  destinations  that  are  over  90 
days  old  from  time  of  shipment  are  traced  by  submission  of  a  ROD 
(Paragraph  VI.B.l.b.,  AFR  400-54). 

The  TAR  has  an  off-line  program  that  indicates  items  for  which 
the  consignee  (receiver)  is  due  credit,  such  as  for  short  shipments. 
This  claims  payable  listing  may  result  in  the  preparation  of  a  ROD  if 
the  situation  meets  the  criteria  for  submitting  a  ROD  (Paragraph 
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VI. A.,  AFR  400-54).  A  ROD,  however,  is  not  submitted  for  every  item 
on  the  TAR. 

FINDING  B:  Reports  Of  Discrepancy  Not  Properly  Processed  Or 
Analyzed.  The  GAO  found  that  the  Clark  Air  Force  supply  office  was 
not  complying  with  Air  Force  guidelines  for  verification  of 
discrepant  shipments  within  15  days  and  the  supply  office  was  not 
having  a  second  person  verify  errors  in  quantity.  The  GAO  performed 
two  tests  of  discrepancy  reports  from  calendar  years  1986  and  1987 
and  found  that  most  of  the  reports  exceeded  the  15-day  standard  and 
did  not  have  discrepancies  in  quantity  verified  by  a  second  person. 
The  GAO  also  found  that  the  supply  squadron  could  not  analyze 
discrepant  shipments  as  required  by  Air  Force  regulations  because  it 
did  not  collect  information  on  reported  discrepancies  to  identify 
causes  and  corrective  actions  that  which  would  prevent  recurrence  of 
the  problem,  (p.  1,  p.  6/GAO  Draft  Report) 

DOD  RESPONSE:  Partially  concur.  The  Department  concurs  that  base 
supply  operations  are  required  to  report  and  verify  discrepancies 
within  established  time  frames.  The  criteria  for  reporting  of 
discrepancies  is  clearly  delineated  in  AFR  400-54  and  AFM  67-1.  The 
PACAF  has  reported  that  Clark  AB  is  now  submitting  RODs  within 
established  time  frames  and  has  ensured  compliance  with  proper 
processing.  There  is,  however,  no  requirement  in  the  Air  Force  or 
the  DoD  policy  that  requires  the  supply  squadron  receiving  material 
to  analyze  discrepant  shipment  data  and  identify  trends.  This 
responsibility  lies  with  the  shipping  activity.  The  Department 
recommends  reference  to  trend  analysis  at  Clark  AB  be  deleted. 

FINDING  C:  Physical  Security  Weaknesses.  According  to  the  GAO,  from 
January  1984  to  May  1987,  the  supply  squadron  reported  suspected 
property  thefts  totaling  about  $3.6  million.  In  spite  of  these 
losses,  the  GAO  found  numerous  and  pervasive  weaknesses  in  the 
physical  security  practices  employed  by  the  supply  squadron  at  Clark 
Air  Force  Base  that  could  impair  the  base  supply  security  programs. 
The  weaknesses  identified  by  the  GAO  involved: 

personnel  identification  and  visitor  registration; 

pilferable  item  controls; 

security  equipment;  and 

perimeter  security. 

The  GAO  observed  that  similar  physical  security  weaknesses  have  been 
identified  by  Air  Force  inspectors  and  investigators.  The  GAO  also 
found  that  the  supply  squadron  did  not  follow  its  security 
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regulations  on  the  use  of  identification  badges  or  registration  of 
visitors  to  the  supply  compound.  In  addition,  the  GAO  found  that 
security  personnel  were  not  inspecting  all  packages  that  were  carried 
through  the  pedestrian  gate.  The  GAO  observed  20  pilferable  items 
that  were  not  properly  stored  in  the  security  cage;  instead,  they 
were  being  stored  in  a  delivery  area.  The  GAO  further  found  that, 
although  the  supply  office  did  use  video  cameras  for  security,  the 
cameras  were  positioned  in  such  a  manner  as  to  preclude  monitoring  of 
the  material  receipts  staging  area,  the  receiving  security  cage,  and 
strategic  gate  and  perimeter  fence  areas.  Finally,  the  GAO  found 
large  holes  in  many  areas  of  the  supply  compound  perimeter  fence 
which  could  allow  unauthorized  personnel  access  to  the  compound. 

(The  GAO  noted  that  during  their  visit,  the  Civil  Engineering 
squadron  approved  two  work  orders  to  correct  problems  in  areas  of 
frequent  intrusion.)  The  GAO  identified  an  August  1985  Air  Force 
inspection  team  report  and  a  July  1987  Air  Force  Office  of  Special 
Investigations  report  that  reported  physical  security  weaknesses  at 
the  Clark  Air  Base  supply  compound.  The  GAO  concluded  that  many  of 
those  same  weaknesses  were  previously  identified,  (p.  2,  pp.  7-10/GAO 
Draft  Report) 

DOD  RESPONSE:  Concur.  The  Department  concurs  that  the  Air  Force  and 
Clark  AB  had  recognized  the  need  for  security  of  government  assets 
and  had  established  security  controls.  There  appeared  to  be  a  lack 
of  compliance  with  these  established  security  measures.  Since  the 
1986-87  GAO  visit,  management  at  Clark  AB  has  increased  its 
involvement  in  monitoring/spot  checking  control  point  guards  and 
security  teams  to  ensure  that  these  individuals  actively  and 
aggressively  support  the  security  program.  The  Clark  AB  has 
increased  the  number  of  personnel  working  in  security  related  jobs, 
effected  more  elaborate  visitor  control/warehouse  security 
procedures,  and  man  warehouses  24  hours  per  day/7  days  per  week.  A 
two-member  roving  supply  team  patrols  all  compound  and  supply  areas 
and  security  police  canine  patrols  also  patrol  inside  the  compound 
area.  Holes  in  the  fence  line  continue  to  be  a  problem,  but  are 
immediately  reported  to  the  security  police  and  civil  engineer  for 
repair.  Supply  personnel  guard  the  perimeter  whenever  immediate 
repair  is  not  possible.  Although  there  are  only  14  authorized 
security  related  jobs,  there  are  currently  35  personnel  working  in 
this  area,  indicating  increased  interest.  With  continued 
senior-level  involvement  in  the  security  programs,  plus  automated 
inventory  analysis  programs,  the  protection,  security  and  control  of 
supply  assets  are  enhanced. 

FINDING  D:  Limited  Control  Over  Computer  System  Access .  The  GAO 
reviewed  Air  Force  regulations  that  require  computer  users  to  sign 
off  a  terminal  when  finished.  The  GAO  explained  that  this 
documentation  of  who  used  the  terminal  helps  limit  access  to  the 
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computer  terminals  to  authorized  staff.  The  GAO  found  that  the  Clark 
Air  Base  supply  squadron  documented  user  identity,  but  had  no  way  to 
determine  sign  on  and  sign  off  times.  The  GAO  concluded,  therefore, 
that  the  squadron  could  not  identify  long  use  times,  which  might 
indicate  a  terminal  being  left  unattended  or  limit  terminal  use  to 
normal  shifts  by  identifying  patterns  of  transactions  at  unusual 
times.  The  GAO  discussed  this  same  problem  with  the  Hickam  Air  Base 
supply  computer  security  officer  and  found  that  Hickam  Air  Base  also 
does  not  determine  sign  on  and  off  times.  The  GAO  also  noted  that 
separating  supply  receipt  and  issue  automated  input  duties  reduces 
the  risk  of  system  abuse.  The  GAO  stated  that  the  Air  Force  guidance 
does  not  require  that  these  supply  management  duties  be  separated  in 
its  automated  processing  system.  The  GAO  found  that  19  of  21 
receiving  personnel  and  134  of  261  squadron  supply  personnel  could 
perform  both  receipt  and  issue  supply  transactions. 

(p.  2,  pp.  10-11/GAO  Draft  Report) 

DOD  RESPONSE:  Partially  concur.  The  Department  concurs  that  bases 
should  control  access  to  automated  systems  to  reduce  the  risk  of 
potential  abuse.  The  DoD  does  not,  however,  concur  that,  in 
practice,  it  is  mandatory  to  have  different  people  enter  receipt  and 
issue  data  or  that  it  is  essential  to  document  the  times  when 
personnel  have  access  to  computer  terminals. 

Protection  of  the  supply  database  from  unauthorized  transactions  is 
essential  and  that  access  should  be  consistent  with  responsibilities. 
The  Air  Force  Audit  Agency  Draft  Report,  Project  7136512,  "Adequacy 
of  Internal  Controls  Over  Automated  Processing,"  June  1988,  evaluated 
ADP  controls  throughout  the  Air  Force.  Since  the  Air  Force  Audit 
Agency  task  concentrated  on  ADP  controls,  its  findings  were  more 
extensive  than  the  GAO  findings  regarding  Clark  AB.  The  Air  Force 
Audit  Agency  cited  some  of  the  same  problems  identified  by  the  GAO. 
The  Air  Force  concurred  with  the  report  and  in  September,  1988,  sent 
a  message  (Subject:  Controlling  Access  to  Automation)  to  all  its 
Major  Commands.  The  message  states  that  assignment  of  Transaction 
Identification  Codes  (TRICs)  and  Transaction  Processor  Passwords 
(TPPs)  should  be  assigned  consistent  with  the  individual's 
responsibilities,  such  as  receiving  and  shipping.  The  message  stated 
that  access  to  systems,  TPPs  and  TRICs  not  consistent  with 
responsibilities  should  be  deleted.  The  message  also  required  that 
each  Chief  of  Supply  conduct  period  reviews  of  TPPs  and  TRICs  and 
that  Major  Commands  should  make  this  a  special  interest  item  during 
staff  assistance  visits.  In  addition,  Air  Force  Manual  67-1  requires 
the  quarterly  verification  of  password  and  TRIC  authorizations,  as 
well  as  daily  monitoring  for  password  abuse.  Additionally,  the  Air 
Force  has  recently  increased  its  emphasis  on  automation  security. 

The  Assistant  Chief  of  Staff  for  Command,  Control,  Communications, 
and  Computers,  Headquarters,  USAF,  is  developing  lock-out  controls 
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and  procedures  for  remote  terminals  and  more  restricted  demand 
password  access.  The  Standard  Communications-Computer  Systems 
Manager  (SCSM)  has  prioritized  work  which  will  result  in  developing 
control  edits  and  audit  trails  necessary  to  validate  and  monitor 
transactions  using  floppy  disks  or  pseudo  processing  techniques. 
Regulatory  guidance  has  been  revised  to  specifically  identify 
terminal  area  security  officer  duties,  responsibilities  and  training 
requirements . 

When  Clark  AB  implements  the  September  1988  message,  it  will  have 
complied  with  the  GAO  recommendation.  As  stated  previously,  the 
Department  concurs  in  principal  with  the  separation  of  duties  and 
computer  access;  however,  smaller  supply  operations  often  find  it 
necessary  to  have  the  same  person  enter  both  receipt  and  issue  data 
into  the  computer.  The  Department,  therefore,  doe3  not  concur  that 
separation  of  duties  be  a  mandatory  requirement  in  all  cases. 

The  Department  concurs  that  having  sign  in/off  times  included  in 
systems  software  would  provide  an  additional  audit  trail,  documenting 
which  individuals  accessed  the  system,  and  the  time  and  duration  of 
the  access.  The  Air  Force  policy  is  that  this  not  be  required.  The 
rationale  is  that  the  programing  effort  involved  would  not  be  cost 
effective  considering  all  the  other  automated  systems  security 
measures  in  effect.  The  return  of  this  added  control  does  not  merit 
the  resources  expended.  It  is  the  Department's  position  that  the 
controls  in  place  at  Clark  AB  are  in  accordance  with  the  guidelines 
contained  in  the  Office  of  Management  and  Budget  Circular  No.  A-130, 
December  12,  1985.  The  DoD,  therefore,  doe3  not  concur  with  the 
finding  that  recording  individual  computer  time  is  essential.  The 
Department  could,  however,  concur  with,  "The  Air  Force  should  ensure 
that  it  applies  adequate  controls  to  the  access  of  automated  data 
bases,  to  include  the  separation  of  input  responsibilities  by 
function,  where  practical."  (See  the  DoD  response  to  RECOMMENDATION 
2.) 


RECOMMENDATIONS 


Now  on  p.  2. 


RECOMMENDATION  1 :  The  GAO  recommended  that  the  Secretary  of  the  Air 
Force  ensure  that  Air  Force  installations  submit  discrepancy  reports 
for  all  overdue  material  shipments,  (p.  3/GAO  Draft  Report) 

DOD  RESPONSE:  Partially  concur.  The  Department  concurs  that  the  Air 
Force  installations  should  submit  follow-ups  for  overdue  material 
shipments.  The  Air  Force  will  issue  guidance,  by  December  1,  1988, 
to  reemphasize,  clarify  and  ensure  that  its  activities  apply  the 
appropriate  follow-up  criteria  regardless  of  the  funding  source. 
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The  Department  does  not  concur  that  overdue  shipments  necessarily 
result  in  a  Report  of  Discrepancy.  The  Department  could  concur  with 
a  recommendation  that  states,  "The  Secretary  of  the  Air  Force  should 
ensure  that  Air  Force  installations  follow-up  on  overdue  material 
shipments  in  accordance  with  Department  of  Defense  guidance."  (See 
See  comment  2  the  DoD  response  to  FINDING  A.) 

RE COMENDAT I ON  2:  The  GAO  recommended  that  the  Secretary  of  the  Air 
Force  incorporate  computer  supply  system  controls  in  the  Air  Force 
guidance.  In  particular,  the  GAO  suggested  that  the  guidance  should 
specify  controls  to  (1)  ensure  separation  of  duties  for  receipt  and 
issue  transactions  and  (2)  document  the  times  when  personnel  have 
Now  on  p.  2  access  to  computer  terminals,  (p.  3/GAO  Draft  Report) 

DOD  RESPONSE:  Partially  concur.  The  Department  concurs  in  principle 
that  the  separation  of  receipt  and  issue  duties  provides  an  extra 
measure  of  control.  The  Department  does  not,  however,  concur  that 
this  should  be  a  mandatory  requirement.  The  Department  also  does  not 
concur  that  it  is  essential  to  document  the  times  when  personnel  have 
access  to  computer  terminals.  The  Department  ha3  controls  and 
actions  in  DoD  guidance  to  assure  control  of  access  and  individual 
accountability  be  identified  to  the  ADP  system  by  appropriate 
administrative  or  hardware /software  measures.  Such  identification 
measures  must  be  in  sufficient  detail  to  enable  the  ADP  system  to 
provide  the  user  only  that  material  which  he  is  authorized.  The 
Department  could  concur  with  a  recommendation  stating:  "The 
Secretary  of  the  Air  Force  should  ensure  that  it  applies  adequate 
access  controls  to  computer  supply  system  data  bases,  to  include  the 
separation  of  input  responsibilities  by  function,  where  practical." 
See  comment  2.  (See  the  DoD  response  to  FINDING  D.) 

RECCM4ENDAT I ON  3 :  The  GAO  recommended  that  the  Secretary  of  the  Air 

Force  direct  the  Clark  Air  Base  supply  squadron  to  correct  the 
specific  weaknesses  the  GAO  identified,  including  physical  security 
and  timely  reporting,  verification  and  trend  analysis  of 
Now  on p  2  discrepancies,  (p.  3/GAO  Draft  Report) 

DOD  RESPONSE:  Partially  concur.  The  Department  concurs  that  all  the 
Air  Force  bases,  including  Clark  AB  and  its  supply  squadron,  should 
take  all  actions  necessary  to  secure  their  assets  and  effect  timely 
reporting.  In  fact,  Clark  AB  has  taken  several  actions  to  improve 
its  security  since  this  audit  was  conducted  over  one  year  ago  (refer 
to  the  DoD  response  to  FINDING  C) .  The  HQ,  PACAF,  has  reported  that 
Clark  AB  now  submits  RODS  within  the  prescribed  time  frames  and  that 
all  receipt  shortages/overages  are  being  verified  by  a  second  person. 

The  Department  concurs  that  the  analysis  of  discrepancies  should  be 
conducted.  The  Department,  however,  does  not  concur  with  the  GAO 
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Comments  From  the  Department  of  Defense 


recommendation  to  direct  Clark  AB  to  conduct  trend  analysis  of 
discrepancies.  The  applicable  regulations,  AFR  400-54  and  AFM  67-1, 
require  the  activity  receiving  RODs  (the  material  shipper)  to 
maintain  records,  conduct  evaluations,  and  initiate  corrective 
actions  on  unresolved  RODs,  not  the  submitter  of  RODs  (the  receiver 
of  the  material) .  There  is  no  requirement  for  receiving  activities 
to  analyze  discrepancies  in  incoming  shipments.  The  DoD  recommends 
that  the  report  delete  reference  to  requiring  Clark  AB  to  conduct 
See  comment  2  such  trend  analysis,  in  accordance  with  the  DoD  response  to  FINDING 

B. 
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Comments  From  the  Department  of  Defense 


The  following  are  gad's  additional  comments  on  hod’s  letter  dated 
November  2,  1988. 


GAO  Comments 


1 .  We  agree  and  have  deleted  the  reference  to  trend  analyses. 

2.  We  agree  and  have  modified  the  recommendations  to  recognize  dod’s 
comments. 
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National  Security  and 
International  Affairs 
Division,  Washington, 
D.C. 


Martin  M  Ferber.  Senior  Associate  Director.  (202)  21 
l  ldis  Adamsons.  Group  Director 


Far  East  Office, 
Honolulu,  Hawaii 


Elliott  C.  Smith,  Evaluator-in-Charge 
Glenn  J.  Chaney.  Site  Senior 
Robert  C.  Howes.  Evaluator 
David  .1.  Wise.  Evaluator 
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